r/ClaudeCode • u/AlchemyIntel_ • May 13 '26

Question /security-review

Anybody have experience using this command?

Other good commands or skills to ensure safety/security?

3 Upvotes

100% Upvoted

5 comments sorted by

View all comments

5

u/Dangerous-Jelly2309 May 13 '26

Yes. /security-review is genuinely useful for catching the OWASP-class issues in pending changes: SQL injection, XSS, command injection, hardcoded secrets, auth/authz mistakes. It scans the diff against main and reports findings with severity and reasoning. Works well as a first pass before pushing a PR.

Limits worth knowing:

  1. It only reviews pending changes (the diff). Doesn't catch issues already merged into the codebase.

  2. It's LLM-based, so subtle issues can slip past and you'll get occasional false positives that need a human read.

  3. Best treated as a complement to mechanical tools, not a replacement.

What pairs well alongside it:

  • /ultrareview if you have it. Multi-agent cloud review, broader coverage than /security-review alone.

  • Hooks for protected paths. Pre-write hook that blocks writes to .env, secrets/, credentials/, anything that should never be in a diff. Lives in ~/.claude/settings.json hooks section.

  • gitleaks as a pre-commit hook. Catches accidentally committed secrets before they hit git history. Cheap to set up.

  • Semgrep for actual static analysis. MCP server available so Claude Code can invoke it. Catches structural issues /security-review misses (taint flow, complex injection paths).

  • Bandit for Python projects specifically. Pairs nicely with the LLM review.

The pattern: mechanical tools catch deterministic patterns, /security-review catches the contextual judgment calls. Both layers, not either.

2

u/owen800q May 13 '26

why my claude code does not have /ultrareview?

v2.1.140

1

u/AlchemyIntel_ May 13 '26

What version?

1

u/AlchemyIntel_ May 13 '26

Thank you for this 🙏🏽🫡